-
Notifications
You must be signed in to change notification settings - Fork 16
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Prevent CoG pages from being included in IFRAMEs #1314
Comments
Following suggestion, executed 2 actions: o CoG pages now set the header X_FRAME_OPTIONS = 'DENY' that is respected by modern browsers to prevent pages to be embedded in IFRAMEs o Also, a little piece of JavaScript code in "layout_base.html" will protect older browsers, since the embedded page will be reloaded as the top level page. |
I assume this does not affect other pages from being embedded in cog? On Wed, Aug 24, 2016 at 10:22 AM, Luca Cinquini notifications@github.com
Sylvia Murphy |
Probably not but it is a bad practice anyway… IFRAME should be eliminated…
|
maybe so, but it is one of the critical functions for the boss. On Wed, Aug 24, 2016 at 10:47 AM, Luca Cinquini notifications@github.com
Sylvia Murphy |
Let’s discuss this later today
|
It turns out that I had to back out of two changes: o X_FRAME_OPTIONS = 'DENY' will break image upload with CKEditor, so I restored the default X_FRAME_OPTIONS = 'SAMEORIGIN' o The JS code in layout_base.html to bust out of frames also breaks image upload, so I removed it. |
Who: NOAA security review
The NOAA security review has identified a potential XSS vulnerability since CoG pages can potentially be included in IFRAME tags on other sites.
The text was updated successfully, but these errors were encountered: